# DoD Pauses CMMC Phase 2

The Department of Defense has paused CMMC Phase 2 third-party certification, but contractors handling controlled unclassified information must continue to meet existing security and self-assessment obligations. The proposed CPARS shift to reporting only negative events did not become law, while firm-fixed-price is identified as the government’s new default. DoD guidance on commercial past-performance records is due December 18, 2026; as of October 28, that is 51 days away. GSA’s forecast tool can inform pipeline research, but it does not include DoD demand.

- Contractors working with CUI must maintain current security and self-assessment practices; the Phase 2 pause does not remove those obligations.
- Companies should prepare commercial past-performance records ahead of DoD’s December 18 guidance, while treating the CPARS overhaul as unimplemented rather than an enacted change.
- With firm-fixed-price identified as the default, contractors should strengthen cost estimating and assess how pricing risk affects bids.
- Use GSA’s forecast tool as a partial demand signal, not a complete view of federal opportunities, because it excludes DoD.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 27, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- U.S. General Services Administration (GSA)

### Sources
- [Federal contracting's 2027 outlook has shifted noticeably since midyear. 

CMMC Phase 2 is suspended, the CPARS overhaul never actually became law, and fixed-price is now the government's official new default.

Full breakdown: https://t.co/8K4nP97Fdc

#federalcontracting #2027 #C](https://x.com/USFCRGOV/status/2115096207223574853) - twitter-govtech